Communication system, switch, control apparatus, packet processing method, and program

ABSTRACT

A communication system contains a control apparatus and switch(es). The control apparatus transmits, to a switch, two or more flow entries having an identical match condition but having different processing content to be applied, and a condition for changing application priorities of the two or more flow entries. The switch holds the two or more flow entries, and switches the application priorities in accordance with the condition specified by the control apparatus, to process received packet(s).

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application claims priority from Japanese Patent ApplicationNo. 2013-043909 (filed on Mar. 6, 2013) the content of which is herebyincorporated in its entirety by reference into this specification. Thepresent invention relates to a communication system, a switch, a controlapparatus, a packet processing method, and a program, and in particular,relates to a communication system, a switch, a control apparatus, apacket processing method, and a program, where the control apparatus isarranged to centrally control the switch.

TECHNICAL FIELD Background Art

In recent years, technology known as OpenFlow has been proposed (seeNon-Patent Literature 1 and 2). In OpenFlow, communication is taken asend-to-end flow, and path control, failure recovery, load balancing, andoptimization are performed on a per-flow basis. An OpenFlow switch asspecified in Non-Patent Literature 2 is provided with a secure channelfor communication with an OpenFlow controller, and operates according toa flow table in which addition or rewriting is instructed as appropriateby the OpenFlow controller. In the flow table, for each flow there aredefinitions of sets of match conditions (Match Fields) for collationwith packet headers, flow statistical information (Counters), andinstructions (Instructions) that define processing content (see “5.2Flow Table” in Non-Patent Literature 2).

For example, when an OpenFlow switch receives a packet, a search is madefor an entry having a match condition (see “5.3 Matching” in Non-PatentLiterature 2) that matches header information of the received packet,from the flow table. As a result of the search, in a case where an entrymatching the received packet is found, the OpenFlow switch updates theflow statistical information (Counters) and also implements processingcontent (packet transmission from a specified port, flooding, dropping,and the like) described in an Instructions field of the entry inquestion, for the received packet. On the other hand, as a result of thesearch, in a case where an entry matching the received packet is notfound, the OpenFlow switch transmits a request for entry configurationto the OpenFlow controller via the secure channel, that is, a requestfor transmission of control information for processing the receivedpacket. The OpenFlow switch receives a flow entry with processingcontent determined and updates the flow table. In this way, the OpenFlowswitch performs packet forwarding using entries stored in the flow tableas control information.

Patent Literature 1 discloses a configuration where, in a communicationsystem using the abovementioned OpenFlow, an OpenFlow controllergenerates and transmits an encapsulated packet in which a flow entry forrecording and a normal packet are related, and flow entries can becollectively recorded in an OpenFlow switch on a particular path.

Patent Literature 2 discloses a configuration where, in a communicationsystem using the abovementioned OpenFlow, when a plurality ofservice-providing servers that provide a service to a client terminalissue a load balancing request to an OpenFlow controller, the OpenFlowcontroller changes flow entry (entries) configured in the switch.

CITATION LIST Patent Literature

-   [PTL 1] International Publication No. WO2010/103909-   [PTL 2] Japanese Patent Kokai Publication No. JP2011-170718A

Non Patent Literature

-   [NPL 1] Nick McKeown and seven others, “OpenFlow: Enabling    Innovation in Campus Networks”, [online], [Search performed on Feb.    18, 2013], Internet <URL:    http://www.openflow.org/documents/openflow-wp-latest.pdf>-   [NPL 2] “OpenFlow Switch Specification” Version 1.3.1 (Wire Protocol    0x04), [online], [Search performed on Feb. 18, 2013], <Internet URL:    https://www.opennetworking.org/images/stories/downloads/specification/openflow-spec-v1.3.1.pdf>

SUMMARY OF INVENTION Technical Problem

The following analysis is given according to the present invention. Inthe OpenFlow network described above, when a path is once calculated byan OpenFlow controller, packets are forwarded by the path in questionuntil communication is ended. Although path change may be performed asin Patent Literature 2, in such a case also, as long as a new loadbalancing request is not made, packet forwarding by the relevant pathafter the change is continued. In this type of centrally controllednetwork, as a result of path calculation by a control apparatus thereof,a phenomenon occurs where traffic becomes concentrated in a particularlink only.

Clearly, if the OpenFlow controller continuously monitors traffic andrewrites flow entries to change paths, the abovementioned problem can beresolved, but, as in the problem of Patent Literature 1, the increasingload on the OpenFlow controller is not practicable.

It is an object of the present invention to provide a communicationsystem, a switch, a control apparatus, a packet processing method and aprogram, which can contribute to improving flexibility of path controlin a centrally controlled network as represented by OpenFlow describedabove.

Solution to Problem

According to a first aspect there is provided a communication systemthat includes: a control apparatus that transmits, to a switch, 2 ormore flow entries having an identical match condition but differentprocessing content to be applied, and a condition for changingapplication priority among the 2 or more flow entries; and a switch thatholds the 2 or more flow entries and switches application priority inaccordance with a condition specified by the control apparatus, toprocess received packet(s).

According to a second aspect there is provided a switch, connected to acontrol apparatus that transmits to the switch 2 or more flow entrieshaving an identical match condition but different processing content tobe applied, and a condition for changing application priority among the2 or more flow entries; the switch holding the 2 or more flow entries,and switching application priority in accordance with a conditionprescribed by the control apparatus, to process received packet(s).

According to a third aspect there is provided a control apparatus thattransmits to a switch which holds 2 or more flow entries having anidentical match condition but different processing content to beapplied, and switches application priority among the 2 or more flowentries in accordance with a specified condition, to process receivedpacket(s), the control apparatus transmitting the 2 or more flow entriesand the condition for changing the application priority among the 2 ormore flow entries.

According to a fourth aspect there is provided a packet processingmethod that includes: a step of receiving, from a control apparatus, 2or more flow entries having an identical match condition but differentprocessing content to be applied, and a condition for changingapplication priority among the 2 or more flow entries; and a step ofholding the 2 or more flow entries and switching application priority inaccordance with a condition specified by the control apparatus, toprocess received packet(s). This method is associated with a particularmechanism known as a switch that processes received packets by referringto flow entries that are configured from outside.

According to a fifth aspect there is provided a program that executes ona computer which controls a switch that holds 2 or more flow entrieshaving an identical match condition but different processing content tobe applied, and switches application priority among the 2 or more flowentries in accordance with a specified condition, to process receivedpacket(s), the program executing a process of creating the 2 or moreflow entries and a condition for changing application priority among the2 or more flow entries; and a process of transmitting the 2 or more flowentries and the condition to the switch. It is to be noted that thisprogram may be recorded on a computer-readable (non-transient) storagemedium. That is, the present invention may be embodied as a computerprogram product.

Advantageous Effects of Invention

According to the present invention, it is possible to contribute toimproving flexibility in path control in a centrally controlled networkas represented by OpenFlow described above.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a diagram showing a configuration of a first exemplaryembodiment of the present invention.

FIG. 2 is a diagram showing a configuration of a communication system inthe first exemplary embodiment of the present invention.

FIG. 3 is a diagram showing an example of queue information exchangedbetween a control apparatus and a switch in the first exemplaryembodiment of the invention.

FIG. 4 is a diagram showing a configuration of the control apparatus inthe first exemplary embodiment of the invention.

FIG. 5 is a diagram showing an example of a flow entry with distributedprocessing configured in a switch by the control apparatus of the firstexemplary embodiment of the invention.

FIG. 6 is a flowchart showing operations of the control apparatus in thefirst exemplary embodiment of the invention.

FIG. 7 is a diagram for describing operations of the switch in the firstexemplary embodiment of the invention.

FIG. 8 is a diagram for describing operations of the switch in the firstexemplary embodiment of the invention.

FIG. 9 is a diagram for describing an example of an effect achieved bythe first exemplary embodiment of the invention.

DESCRIPTION OF EMBODIMENTS

First, a description is given of an outline of exemplary embodiments ofthe present invention, making reference to the drawings. It is to benoted that reference symbols in the drawings attached to this outlineare added to respective elements for convenience, as examples in orderto aid understanding, and are not intended to limit the presentinvention to modes illustrated in the drawings.

The present invention may be implemented, in an exemplary embodimentthereof as shown in FIG. 1, by a communication system including acontrol apparatus 100A and switches 200-1 to 200-4, where the controlapparatus 100A controls the switches 200-1 to 200-4, and the switches200-1 to 200-4 process received packets by referring to flow entriesconfigured by the control apparatus 100A.

More specifically, the control apparatus 100A, for example, transmitsand holds two or more flow entries having an identical match conditionbut having different processing content to be applied, and a conditionfor changing application priorities of the two of more flow entries.

The switch 200-1 processes a received packet using the flow entry, byswitching application priority in accordance with the conditionspecified by the control apparatus. For example, the processing contentof forwarding (forwarding from port #1) to switch 200-2 is configured inone of the two or more flow entries, and processing content offorwarding (forwarding from port #2) to switch 200-3 is configured inanother thereof. For example, when a condition is configured forchanging application priority of the respective flow entries for each ofa prescribed number of packets received, the switch 200-1 performs anoperation of switching forwarding (forwarding from port #1) to switch200-2 and forwarding (forwarding from port #2) to switch 200-3, for eachof a prescribed number of packets received.

By so doing, a path change operation is implemented on the switch sidealone. It is to be noted that in the abovementioned example, a packetforwarding operation is configured in processing content configured ineach of two flow entries, but it is also possible to configureprocessing content otherwise. For example, if processing content isconfigured to drop a packet in one of the flow entries, it is alsopossible to perform an operation such as packet policing.

First Exemplary Embodiment

Next, a detailed description is given concerning a first exemplaryembodiment of the present invention, making reference to the drawings.FIG. 2 is a diagram showing a configuration of a communication system inthe first exemplary embodiment of the present invention. FIG. 2 shows aconfiguration in which a control apparatus 100 and a switch 200 areconnected via a control channel.

The switch 200 is provided with a plurality of ports A to N, a flowentry storage unit 210 that stores flow entries transmitted from thecontrol apparatus 100, a packet processing unit 220, a queue informationtransmission unit 230, and a priority change unit 240.

On receiving a packet from port C in FIG. 2, for example, the packetprocessing unit 220 searches for a flow entry having a match conditionthat matches the received packet, from the flow entry storage unit 210.As a result of the search, in a case where a flow entry having a matchcondition that matches the received packet is found, the packetprocessing unit 220 applies processing content configured in aprocessing content field (action field) of the flow entry to thereceived packet.

The queue information transmission unit 230 transmits queue informationat prescribed intervals to the control apparatus 100. The queueinformation, as shown in FIG. 3, is the counted number of packetsdropped without being accumulated in a transmission queue for each portof the switch. It is possible to quantitatively comprehend whether ornot a bandwidth deficiency has occurred and the extent thereof, in theport in question according to the number of dropped packets included inthis queue information. It is to be noted that switch ID in FIG. 3 is anID (Datapath ID) uniquely assigned to each switch.

The priority change unit 240, as detailed later, performs an operationto change priorities among distributed processing flow entries having anidentical match condition configured, based on a condition configured bythe control apparatus 100. In the present exemplary embodiment, thepriority change unit 240 compares a flow entry counter value and athreshold specified by the control apparatus 100, and in a case wherethe flow entry counter value exceeds the threshold, clears the counterand also changes application priority (priority among related entries inFIG. 5) among flow entries with an identical match condition (detailsare described later).

FIG. 4 is a diagram showing a configuration of the control apparatus 100in the first exemplary embodiment of the present invention. Referring toFIG. 4, the control apparatus 100 is provided with a distributedprocessing flow entry creation unit 110, a queue information collectionunit 120, and a protocol processing unit 130 for communicating by aprescribed protocol (for example, OpenFlow protocol of Non-PatentLiterature 2) with a switch.

The distributed processing flow entry creation unit 110 creates adistributed processing flow entry to be configured in the switch 200. Itis to be noted that the distributed processing flow entry creation unit110 may create a normal flow entry. Clearly, separately from thedistributed processing flow entry creation unit 110, a flow entrycreation unit may be provided that creates a flow entry based on aresult of path calculation or terminal location.

FIG. 5 is a diagram showing an example of distributed processing flowentries. FIG. 5 shows entries that associate entry ID, match condition,action, related entry ID, priority among related entries, and counter.

The entry ID is an identifier that is configured in order to uniquelyidentify a flow entry at least within a switch.

The match condition field is a field for configuring a match conditionfor collating with header information or the like of a received packet.As the match condition, in the example of FIG. 5, a condition isconfigured in which an “In port” is port C. Clearly, besides an inputport (“In port”), it is possible to configure a MAC (Media AccessProtocol) address (source/destination), an IP (Internet Protocol)address (source/destination), or a TCP/UDP (Transmission ControlProtocol/User Datagram Protocol) port number (source/destination), etc.

The action field is a field for configuring processing content to beapplied to a packet that matches a match condition. In the example ofFIG. 5, an entry (Output port A) configuring an action specifying output(forwarding) from port A as an action, and an entry (Output port B)configuring an action specifying output (forwarding) from port B, areconfigured as actions. It is to be noted that in an action field, notonly an Output action, but also another action (header rewriting,dropping, reference to another table, or the like) can be configured.

The related entry ID is a field that configures the ID of a relatedentry with an identical match condition but a different action field. Inthe example of FIG. 5, 5001 is configured in a related entry ID of flowentry with entry ID=5000, and 5000 is configured in a related entry IDof flow entry with entry ID=5001. That is, the example shows that theflow entry with entry ID=5000 and the flow entry with entry ID=5001 arerelated entries (distributed processing flow entry set) with anidentical match condition but different action fields. It is to be notedthat in the example of FIG. 5, a case with 2 related entries is shown,but there may also be 3 or more related entries. Where a related entryis blank, the flow entry thereof may be handled as a normal flow entry.

Priority among related entries indicates application priority among theaforementioned related entries. In the example of FIG. 5, the smallerthe numerical value, the higher the application priority. For example,in a case where a packet is received from port C, the flow entry withentry ID=5000 and the flow entry with entry ID=5001 are hit, but theflow entry with entry ID=5000, which has higher priority among relatedentries, is selected.

The counter field is a field that holds a count value of the number ofpackets applied to a match condition. In the present exemplaryembodiment, by comparing the counter value with a prescribed threshold,the application priority among related entries is changed. It is to benoted that flow statistical information for each entry recorded by anOpenFlow switch of Non-Patent Literature 2 may be used as the counter,but counters may also be set individually.

As described above, a flow entry may be configured by adding fieldsstoring entry ID, related entry ID, priority among related entries, andthe like, to a flow entry described in “5.2 Flow Table” of Non-PatentLiterature 2.

The queue information collection unit 120 performs operations ofreceiving queue information from the queue information transmission unit230 of the switch 200, and storing this for a prescribed time period.

It is to be noted that the respective parts (processing means) of thecontrol apparatus 100 and switch 200 shown in FIG. 2 and FIG. 4 may beimplemented by a computer program that executes the abovementionedrespective processes on a computer configuring these apparatuses, usinghardware thereof.

Next, a detailed description is given concerning operations of thepresent exemplary embodiment, making reference to the drawings. FIG. 6is a flowchart showing operations of the control apparatus in the firstexemplary embodiment of the invention. Referring to FIG. 6, the controlapparatus 100 collects queue information as exemplified in FIG. 3 fromthe switch 200 at prescribed time intervals (step S001). It is to benoted with regard to transmission units for queue information, queueinformation for each port shown in FIG. 3 may be individuallytransmitted as a unit, or the queue information shown in FIG. 3 may betransmitted collectively for each switch. If, as in the latter, thequeue information shown in FIG. 3 is transmitted collectively for eachswitch, it is possible to reduce the number of transmissions of queueinformation.

Next, the control apparatus 100 selects a flow entry to be changed to adistributed processing flow entry, from among flow entries that havebeen configured in the switch, based on received queue information (stepS002). Specifically, the control apparatus 100 selects a flow entry witha port having many dropped packets as shown in the queue information, asan output destination.

Next, the control apparatus 100 creates a distributed processing flowentry, to be configured by rewriting in the abovementioned flow entry,and configures this in the relevant switch (step S003). For example, inan identical match condition, a flow entry outputting from port A ofswitch 200 of FIG. 7, and a flow entry outputting from port B of switch200 of FIG. 8 are created and configured in a switch as shown in FIG. 5.The control apparatus 100 transmits a condition to change priority to beapplied to a distributed processing flow entry, to the switch 200. Forexample, a condition is transmitted such as: when the counter is 100.The transmitted condition to change priority is held in the prioritychange unit 240 of the switch 200.

An arrangement may be made to enable specifying of a method of changingpriority when the condition is realized. The simplest method is one ofswitching the priorities of 2 flow entries. Besides this, in a case of 3or more distributed processing flow entries, it is possible to use amethod in which the priority of a flow entry having second placepriority or lower is raised by 1, and the priority of a flow entryhaving the previous highest priority is lowered to the lowest position.

In the above way, processing on the control apparatus 100 side iscompleted. Thereafter, operations on the switch 200 side are performed,and on receiving a packet matching a distributed processing flow entry,the switch 200 selects a flow entry with a higher application priority,and processes the packet. At this time, the switch 200 updates thecounter and changes the application priorities among distributedprocessing flow entries, by a condition specified by the controlapparatus 100.

For example, in a case where a distributed processing flow entry isconfigured as shown in FIG. 5, the switch 200, on receiving a packetfrom port C, transmits the packet from port A, as shown in FIG. 7, inaccordance with an action field of the flow entry with entry ID=5000. Atthis time, the switch 200 increments a counter field of the flow entrywith entry ID=5000.

Meanwhile, the priority change unit 240 of the switch 200 refers to thecounter field of the distributed processing flow entry, and determineswhether or not to change the priority of the distributed processing flowentry. For example, in a case where the number of packets received fromport C exceeds a specified threshold, the priority change unit 240 ofthe switch 200 changes the priority of the flow entry with entry=5001 inFIG. 5 to “1”, and changes the priority of the flow entry withentry=5000 in FIG. 5 to “2”. In this way, on receiving a packet fromport C thereafter, the switch 200 transmits the packet from port B, asshown in FIG. 8, in accordance with an action field of the flow entrywith an entry ID=5001.

As described above, according to the present exemplary embodiment it ispossible to apply different processing in operation on a switch side fora packet group matching a certain match condition. For example, if N isused as a threshold to be compared with the counter, the switch performsan operation to change path or processing content each time N of acertain packet are received.

An effect of the present invention is not limited to a case ofconfiguration to 1 switch. For example, as shown in FIG. 9, byconfiguring a distributed processing flow entry set of a type thatswitches respective forwarding destinations, in switches 200-1 to 200-6in a network, it is possible to distribute traffic, as shown by thearrows in FIG. 9. In the example of FIG. 9, the distributed traffic isultimately concentrated at switch 200-7. Therefore, it becomes possibleto reduce the likelihood of dropping at ports along the way, due tocongestion or the like.

A description has been given above of respective exemplary embodimentsof the present invention, but the present invention is not limited tothe abovementioned exemplary embodiments, and modifications,substitutions and adjustments may be added within a scope that does notdepart from fundamental technical concepts of the invention. Forexample, network configurations and element configurations shown in therespective drawings are examples in order to aid understanding of theinvention, and are not intended to limit the invention to configurationsillustrated in the drawings.

For example, in the abovementioned exemplary embodiment, a descriptionwas given in which, by referring to the counter field of the distributedprocessing flow entry, a determination is made as to whether or not tochange the priority of a distributed processing flow entry, but, forexample, it is possible to provide a timer for the switch 200, and tochange application priority of the distributed processing flow entryeach prescribed time period. Clearly, it is also possible to configure acompound condition such as changing application priority of adistributed processing flow entry when either or both the elapse of aprescribed time or receipt of a prescribed number of packets, isestablished.

In a case where the switch 200 has functionality of an OpenFlow switchof Non-Patent Literature 2, it is also possible to create and transmit adistributed processing flow entry, based not on using the abovementionedqueue information but on information (number of processing packets foreach port, each flow entry) obtained using a flow statistical functionthereof.

Finally, preferred modes of the present invention are summarized.

First Mode

(Refer to the communication system according to the first aspectdescribed above.)

Second Mode

The communication system according to the first mode, wherein thecontrol apparatus prescribes, as the condition, content to change theapplication priority each time a counter value set in each flow entryexceeds a prescribed threshold, for the switch.

Third Mode

The communication system according to the first or second mode, whereinthe control apparatus prescribes, as the condition, content to changethe application priority each prescribed time period, for the switch.

Fourth Mode

The communication system according to any one of the first to thirdmodes, wherein the control apparatus determines a switch to transmit thetwo or more flow entries and the condition, based on a counter value foreach flow entry collected from the switch.

Fifth Mode

The communication system according to any one of the first to fourthmodes, wherein the control apparatus collects values of statisticalinformation of packets dropped without being transmitted with regard torespective ports, from the switch; creates, with respect to a flow entryfor which output from a port with many of the dropped packets isprescribed, a flow entry to prescribe output from another port having anidentical match condition; and transmits the created flow entry and acondition to change application priority among the 2 flow entries.

Sixth Mode

The communication system according to the fifth mode, wherein the switchtransmits statistical information of packets dropped without beingtransmitted for each port of the switch, in port units or collectivelyfor each switch, to the control apparatus.

Seventh Mode

(Refer to the switch according to the second aspect described above.)

Eighth Mode

(Refer to the control apparatus according to the third aspect describedabove.)

Ninth Mode

(Refer to the packet processing method according to the fourth aspectdescribed above.)

Tenth Mode

(Refer to the program according to the fifth aspect described above.)

It is to be noted that the seventh to tenth modes described above may beexpanded with regard to the second to sixth modes, similar to the firstmode.

Note that the various disclosures of the abovementioned PatentLiterature and Non-Patent Literature are incorporated herein byreference thereto. Modifications and adjustments of exemplaryembodiments and examples may be made within the bounds of the entiredisclosure (including the scope of the claims) of the present invention,and also based on fundamental technological concepts thereof. Variouscombinations and selections of various disclosed elements (includingrespective elements of the respective claims, respective elements of therespective exemplary embodiments and examples, respective elements ofthe respective drawings, and the like) are possible within the scope ofthe entire disclosure of the present invention. That is, the presentinvention clearly includes every type of transformation and modificationthat a person skilled in the art can realize according to the entiredisclosure including the scope of the claims and to technologicalconcepts thereof. In particular, with regard to numerical rangesdescribed herein, arbitrary numerical values or small ranges included inthe relevant ranges should be interpreted to be specifically describedeven where there is no particular description thereof.

REFERENCE SIGNS LIST

-   100, 100A control apparatus-   110 distributed processing flow entry creation unit-   120 queue information collection unit-   130 protocol processing unit-   200, 200-1 to 200-7 switch-   210 flow entry storage unit-   220 packet processing unit-   230 queue information transmission unit-   240 priority change unit-   A to N port

What is claimed is:
 1. A communication system comprising: a controlapparatus that transmits, to a switch, 2 or more flow entries having anidentical match condition but different processing content to beapplied, and a condition for changing application priority among said 2or more flow entries; and a switch that holds said 2 or more flowentries and switches application priority in accordance with a conditionspecified by said control apparatus, to process received packet(s). 2.The communication system according to claim 1, wherein said controlapparatus prescribes, as said condition, content to change saidapplication priority each time a counter value set in each flow entryexceeds a prescribed threshold, for said switch.
 3. The communicationsystem according to claim 1, wherein said control apparatus prescribes,as said condition, content to change said application priority eachprescribed time period, for said switch.
 4. The communication systemaccording to claim 1, wherein said control apparatus determines a switchto transmit said two or more flow entries and said condition, based on acounter value for each flow entry collected from said switch.
 5. Thecommunication system according to claim 1, wherein said controlapparatus collects values of statistical information of packets droppedwithout being transmitted with regard to respective ports, from saidswitch; creates, with respect to a flow entry for which output from aport with many of said dropped packets is prescribed, a flow entry toprescribe output from another port having an identical match condition;and transmits said created flow entry and a condition to changeapplication priority among said 2 or more flow entries.
 6. Thecommunication system according to claim 5, wherein said switch transmitsstatistical information of packets dropped without being transmitted foreach port of said switch, in port units or collectively for each switch,to said control apparatus.
 7. A switch, connected to a control apparatusthat transmits to the switch 2 or more flow entries having an identicalmatch condition but different processing content to be applied, and acondition for changing application priority among said 2 or more flowentries, the switch holding said 2 or more flow entries, and switchingapplication priority in accordance with a condition prescribed by saidcontrol apparatus, to process received packet(s).
 8. A control apparatusthat transmits to a switch which holds 2 or more flow entries having anidentical match condition but different processing content to beapplied, and switches application priority among said 2 or more flowentries in accordance with a specified condition, to process receivedpacket(s), the control apparatus transmitting said 2 or more flowentries and said condition for changing said application priority amongsaid 2 or more flow entries.
 9. A packet processing method comprising:receiving, from a control apparatus, 2 or more flow entries having anidentical match condition but different processing content to beapplied, and a condition for changing application priority among said 2or more flow entries; and holding said 2 or more flow entries andswitching application priority in accordance with a condition specifiedby said control apparatus, to process received packet(s).
 10. Anon-transitory computer-readable recording medium storing thereon aprogram to execute on a computer that controls a switch that holds 2 ormore flow entries having an identical match condition but differentprocessing content to be applied, and switches application priorityamong said 2 or more flow entries in accordance with a specifiedcondition, to process received packet(s), said program executing aprocess of creating said 2 or more flow entries and a condition forchanging application priority among said 2 or more flow entries; and aprocess of transmitting said 2 or more flow entries and said conditionto said switch.
 11. The communication system according to claim 2,wherein said control apparatus prescribes, as said condition, content tochange said application priority each prescribed time period, for saidswitch.
 12. The communication system according to claim 2, wherein saidcontrol apparatus determines a switch to transmit said two or more flowentries and said condition, based on a counter value for each flow entrycollected from said switch.
 13. The communication system according toclaim 3, wherein said control apparatus determines a switch to transmitsaid two or more flow entries and said condition, based on a countervalue for each flow entry collected from said switch.
 14. Thecommunication system according to claim 2, wherein said controlapparatus collects values of statistical information of packets droppedwithout being transmitted with regard to respective ports, from saidswitch; creates, with respect to a flow entry for which output from aport with many of said dropped packets is prescribed, a flow entry toprescribe output from another port having an identical match condition;and transmits said created flow entry and a condition to changeapplication priority among said 2 or more flow entries.
 15. Thecommunication system according to claim 3, wherein said controlapparatus collects values of statistical information of packets droppedwithout being transmitted with regard to respective ports, from saidswitch; creates, with respect to a flow entry for which output from aport with many of said dropped packets is prescribed, a flow entry toprescribe output from another port having an identical match condition;and transmits said created flow entry and a condition to changeapplication priority among said 2 or more flow entries.
 16. Thecommunication system according to claim 4, wherein said controlapparatus collects values of statistical information of packets droppedwithout being transmitted with regard to respective ports, from saidswitch; creates, with respect to a flow entry for which output from aport with many of said dropped packets is prescribed, a flow entry toprescribe output from another port having an identical match condition;and transmits said created flow entry and a condition to changeapplication priority among said 2 or more flow entries.